T -dominance: Prioritized Defense Deployment for BYOD Security IEEE CNS 2013 Wei Peng1
Feng Li1 1 Indiana
Keesook J. Han2
Xukai Zou1
Jie Wu3
University-Purdue University Indianapolis 2 Air
Force Research Laboratory 3 Temple
University
14 October 2013
Approved for Public Release; Distribution Unlimited: 88ABW-2012-4117, 25-Jul-2012. T -dominance
14 October 2013
1 / 16
bring your own device (BYOD)
I
an enterprise IT policy rising with blackberry/smartphones. . .
I
. . . that encourage employees to user their own devices to access the enterprise IT infrastructure at work some cited justifications
I
I I I
I
employees’ demand/satisfaction decreased IT acquisition and support cost, increased use of virtualization
security concerns I I
I
“bring your own virus” inadvertenly or maliciously bring malware on a personal device to other devices. . . . . . through the enterprise network behind firewalls
T -dominance
14 October 2013
2 / 16
prioritized defense deployment motivation I
I
BYOD devices need to be monitored and audited for malware protection. . . . . . but constantly doing so on all devices: I I
negates the perceived convenience is costly to implement
idea I
observation: some device are more security-wise representative
I
prioritize these devices for defense deployment
question I
How to define security-wise representative?
I
How to find these users?
T -dominance
14 October 2013
3 / 16
T -dominance as a structural property on temporal-evolving topology
the black node is security-wise representative. . . . . . because it T -dominants the white nodes with T = 4
T -dominance
14 October 2013
4 / 16
T -dominance as a distributed algorithm that constructs a T -dominating set
the T -dominating set election process is carried out by individual nodes. . . . . . with knowledge of local (rather than global) neighborhood
T -dominance
14 October 2013
4 / 16
T -dominance as a prioritized defense deployment strategy
more stringent security mechanism deployed on the T -dominating set. . . . . . provides a quantified (by T ) security trade-off. . . . . . between deployment cost and detection delay T -dominance
14 October 2013
4 / 16
T -dominance structural property I
given connectivity history1 , expected encounter delays (reachability) r(u, v) between devices u, v ∈ P = {u, v, w, . . .} can be estimated details
I
GT (P ) (reachability graph filtered by T ): undirected graph with P as vertices and r(u, v) as weight on edge (u, v), and all edges with weight greater than T removed
Definition (T -dominance) Let P be a set of devices and A be a subset of P called the agents. Agents A are said to T -dominate the smartphones P at moment t if, for any u ∈ GT (P ), either u ∈ A or u is a neighbor of an agent a ∈ A in GT (P ). I
1
example: prioritizing a T -dominating set for deploying a security patch will have the patch reach all devices within a maximal delay of T with a high probability a built-in feature of many smartphones T -dominance
14 October 2013
5 / 16
T -dominance distributed algorithm overview
info exchange upon encounters. . . I agent keeps info on encountered devices; non-agent does not I time-stamped info: device ID, agent/non-agent status, connectivity history I info helps make the following activation/deactivation decisions I u constructs its domination graph GD (u), based on exchanged info
. . . plus 2 circumstances I agent meets agent: deactivation I agent meets non-agent: activation T -dominance
14 October 2013
6 / 16
T -dominance distributed algorithm deactivation I
I
when agent u meets another agent (after u has been an agent for at least a period of W ), u decides whether to deactivate itself N [w] = N (w) ∪ {w}: the closed neighborhood of w ∈ GD (u)
2 alternative decision rules for u I Individual. u deactivates itself if there exists an agent w with higher priority in GD (u) so that N [u] ⊆ N [w]. I Group. u deactivates itself if there exists a connected set of agents U in GD (u), S each of which has a higher priority than u, so that N [u] ⊆ w∈U N [w]. Such a U is said to be a replacement of u. 2 alternative priority comparisons I Strong. w has a priority higher than u if 1) N∩ 6= ∅; 2) ∃x ∈ N∩ , r(x, w) < r(x, u); 3) ∀x ∈ N∩ , r(x, w) ≤ r(x, u). I Weak. w has higher priority than u if 1) N∩ 6= ∅; 2) P P x∈N∩ r(x, w) < x∈N∩ r(x, u). T -dominance
14 October 2013
7 / 16
T -dominance distributed algorithm activation I I I
when agent u meets non-agent v, u decides whether to activate v problem: indiscriminate activation wastes resources in thrashing solution: activate v unless it is highly likely to be deactivated later
2 consecutive stages I Deactiviability. u pretends v is an agent, plays v’s role in u’s own perspective GD (u) I I
I
if v is not to be deactivated, then u activates v if v is to be deactivated, then u proceeds to the next stage.
Coverage. u estimates v’s unique coverage (in addition to the agent set A(u) that u knows of) and activates v with a corresponding probability I I
c(v\A(u)): v’s unique coverage; c(A(u)): A(u)’s total coverage u activates v with a probability: 1 − exp(− T -dominance
c(v\A(u)) ). c(A(u)) 14 October 2013
8 / 16
T -dominance algorithm properties 3 properties
Property (Correctness) The T -dominance structural property is maintained by the algorithm.
Property (Localization) An agent makes its activation/deactivation decisions locally.
Property (Temporal robustness) Correctness is achieved even if the info obtained from other devices is outdated.
T -dominance
14 October 2013
9 / 16
T -dominance algorithm properties the key to temporal robustness
Theorem If an agent a deactivates itself in its local (and potentially outdated) view at the moment t, then, in the global (and updated) view, each of the devices T -dominated by a, including a itself, is still T -dominated by some agent at t.
T -dominance
14 October 2013
10 / 16
evaluation data set and preprocessing
dataset I from the Wireless Topology Discovery (WTD) project2 I collected from over 150 UC San Diego freshmen using hand-held mobile devices over an 11-week period I periodic Wi-Fi AP scanning and association results were recorded every 20 seconds preprocessing I consecutive association records (every 20 seconds) are combined into a single session I took the first 200 record entries I use the first 30% of the data (with 190 nodes) to accumulate connectivity history I some nodes are randomly selected as initial agents I simulate the activation/deactivation processes 2
http://sysnet.ucsd.edu/wtd/data_download/wtd_data_release.tgz T -dominance
14 October 2013
11 / 16
evaluation agent election results
agent election is normalized by the epidemic activation strategy
T -dominance
14 October 2013
12 / 16
evaluation prioritized defense deployment effectiveness
compare at the same rate I
T -dominance-based strategic malware sampling/patching
I
random sampling/patching
on different malware propagation model I
epidemic propagation
I
static/no propagation
T -dominance
14 October 2013
13 / 16
evaluation prioritized defense deployment effectiveness
the delay till first detection T -dominance strategic sampling can detect malware faster than random sampling T -dominance
14 October 2013
13 / 16
evaluation prioritized defense deployment effectiveness
the number of malware infected nodes averaged over the whole time period T -dominance strategic patching is more effective in preventing malware epidemic than random patching T -dominance
14 October 2013
13 / 16
take-aways
I
prioritized defense deployment provides a less-intrusive BYOD security solution
I
T -dominance provides a quantified trade-off between defense deployment cost and time-to-full-coverage
I
the activation/deactivation distributed algorithm preserves the T -dominance structural property with temporal robustness
I
T -dominance-based strategy sampling/patching is more effective than random sampling/patching
T -dominance
14 October 2013
14 / 16
thank you
T -dominance
14 October 2013
15 / 16
I
connectivity log entry (ST = s, ET = e, AP ID = APi ): the device is associated with access point APi from time s to e
I
given u and v’s connectivity logs, find encounter durations in time window [t − W, t] to be [s1 , e1 ], [s2 , e2 ], . . . , [sk , ek ] (define sk+1 = s1 + W )
I
at time m, delay until the next encounter: 0 ∃i, s.t. si ≤ m ≤ ei , g(m) = minsi ≥m (si − m) otherwise.
I
reachability between u and v as expected delay: R sk+1 Pk g(m)dm (si+1 − ei )2 s1 r(u, v) = = i=1 . W 2W
back to T -dominance definition
T -dominance
14 October 2013
16 / 16
